ADFS provides access control and single sign on (SSO) across a wide variety of applications (Office 365, cloud based SaaS applications, and applications on the corporate network.

What’s new in ADFS in Windows Server 2016:

Eliminate Passwords from the Extranet

ADFS 2016 enables three new options for sign on without passwords.

Sign in with Azure Multi-factor Authentication:

ADFS 2016 builds upon the multi-factor authentication (MFA) capabilities of ADFS in Windows Server 2012 R2 by allowing sign on using an Azure MFA code, without first entering a username and password.

• With Azure MFA as the primary authentication method, the user is prompted for their username and the OTP (One Time Password) code from the Azure Authenticator app.
• With Azure MFA as the secondary or additional authentication method, the user provides primary authentication credentials (Windows Integrated Authentication, username and password, smart card, or user or device certificate), then sees a prompt for text, voice or OTP based Azure MFA login.
• Azure MFA can be configured for intranet or extranet, or as part of any access control policy.

Password-less Access from Compliant Devices:

ADFS 2016 builds on previous device registration capabilities to enable sign on and access control based the device compliance status. Users can sign on using the device credential, and compliance is re-evaluated when device attributes change, so that you can always ensure policies are being enforced.

• Enable Access only from devices that are managed and/or compliant
• Enable Extranet Access only from devices that are managed and/or compliant
• Require multi-factor authentication for computers that are not managed or not compliant

Sign in with Microsoft Passport:

ADFS 2016 supports Windows 10 authentication capabilities (PIN, biometric gesture like fingerprint, or facial recognition) so that users can sign in to ADFS applications from the intranet or the extranet without the need to provide a password.

Secure Access to Applications

Modern Authentication:

ADFS 2016 supports the latest modern protocols for Windows 10, IOS and Android devices and apps.

Access control policies with built in templates:

Previously, AD FS administrators had to configure policies using the AD FS claim rule language, making it difficult to configure and maintain policies. With access control policies, administrators can use built in templates to apply common policies.

• Permit intranet access only
• Permit everyone and require MFA from Extranet
• Permit everyone and require MFA from a specific group

Enable sign on with non-AD LDAP directories:

Many organizations have a combination of Active Directory and third-party directories. With the addition of AD FS support for authenticating users stored in LDAP v3-compliant directories, AD FS can now be used for

• Users in third party, LDAP v3 compliant directories
• Users in Active Directory forests to which an Active Directory two-way trust is not configured
• Users in Active Directory Lightweight Directory Services (AD LDS)

Better Sign in experience

Customize sign in:

Previously, AD FS in Windows Server 2012 R2 provided a common sign on experience for all relying party applications, with the ability to customize a subset of text based content per application. With Windows Server 2016, you can customize not only the messages, but images, logo and web theme per application. Additionally, you can create new, custom web themes and apply these per relying party.

Manageability and Operational Enhancements

Streamlined auditing for easier administrative management:

With the release of AD FS 2016, auditing has become more streamlined and less verbose.

Improved interoperability with SAML 2.0 for participation in confederations:

AD FS 2016 contains additional SAML protocol support, including support for importing trusts based on metadata that contains multiple entities. This enables you to configure AD FS to participate in confederations such as InCommon Federation and other implementations conforming to the eGov 2.0 standard.

Simplified password management for federated O365 users:

You can configure Active Directory Federation Services (AD FS) to send password expiry claims to the relying party trusts (applications) that are protected by AD FS. How these claims are used depends on the application. For example, with Office 365 as your relying party, updates have been implemented to Exchange and Outlook to notify federated users of their soon-to-be-expired passwords.

Moving from ADFS in Windows Server 2012 R2 to ADFS in Windows Server 2016 is easier:

Now, moving from AD FS on Windows Server 2012 R2 to AD FS on Windows Server 2016 has become much easier. Simply add a new Windows Server 2016 server to a Windows Server 2012 R2 farm, and the farm will act at the Windows Server 2012 R2 farm behavior level, so it looks and behaves just like a Windows Server 2012 R2 farm.

Then, add new Windows Server 2016 servers to the farm, verify the functionality and remove the older servers from the load balancer. Once all farm nodes are running Windows Server 2016, you are ready to upgrade the farm behavior level to 2016 and begin using the new features.